It's a FortiGate 600E cluster, running on FortiOS 6.4.6. The NPS is a Windows Server 2019.
The setup is working fine with when we use PAP authentication between the FortiGate and the NPS, but because this method is not secure, we want to use MS-CHAPv2 for authentication.
On the FortiGate we have specified MS-CHAP-v2 as authentication method in the RADIUS server settings. MS-CHAPv2 is also enabled on the Connection Request Policy and the Network Policy on our Windows NPS. Unfortunately, authentication is not working.
When we try to connect the SSL VPN, the FortiClient gives the following errror: credential or ssl vpn configuration is wrong (-7200). The RADIUS requests are arriving at our NPS but the NPS event logs don't give me any usefull information.
I already tried switchting between MS-CHAPv2, MS-CHAP and CHAP, but none of them are working. Authentication is only working with PAP.
By default the RADIUS client on the FortiGate is set to auto negotiate the auth type and will try PAP, MSCHAPv2, and then CHAP in that order, and use the first one it finds (don’t ask me why it is in that order). You can either force it to only use MSCHAPv2 on the FortiGate side, or disable PAP as an auth method in the network policy on NPS and it should negotiate to something else. See auth-type options in the CLI https://docs.fortinet.com/document/fortigate/7.0.1/cli-reference/496620/config-user-radius
# set auth-type
auto Use PAP, MSCHAP_v2, and CHAP (in that order).
ms_chap_v2 Microsoft Challenge Handshake Authentication Protocol version 2.
ms_chap Microsoft Challenge Handshake Authentication Protocol.
This is a great reference Raymon, but it doesn't work for me, unfortunately. I configured the ms_chap_v2 via CLI, but the Event log on the RADIUS Server still getting that the authentication type is PAP.
Firewall 6.0.4 config user radius edit "SRVRD01" set server "192.168.x.x" set secret "keep secret" set auth-type ms_chap_v2 set source-ip "192.168.x.x" next
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.